Critical WordPress plugin flaw exposes websites to takeover
Take action: If you use the "Database for Contact Form 7, WPforms, Elementor forms" plugin on any WordPress site, time to update NOW. You can't mitigate this flaw because the plugin is visible on the internet. So don't delay, the update is trivial.
Learn More
A security vulnerability is reported in "Database for Contact Form 7, WPforms, Elementor forms" WordPress plugin that could allow unauthenticated attackers to compromise websites without authentication.
The plugin is a database management tool for popular WordPress form builders, automatically saving form submissions from Contact Form 7, WPforms, Elementor Forms, CRM Perks Forms, and many other contact form plugins to the WordPress database.
The vulnerability is tracked as CVE-2025-7384 (CVSS score 9.8) and is caused by improper handling of user input in the plugin's get_lead_detail function, which fails to sanitize data before performing deserialization operations. This flaw allows unauthenticated attackers to inject malicious PHP objects into the application without requiring any user credentials or special access.
The most severe attack scenario involves the deletion of critical WordPress configuration files, like acessing or deleting the wp-config.php file is deleted. The wp-config.php file contains critical database credentials, security keys, and other essential configuration settings for WordPress installations. Its deletion can render websites completely inaccessible or, in certain configurations, provide attackers with opportunities to achieve remote code execution on the target server.
Affected versions are all versions of the "Database for Contact Form 7, WPforms, Elementor forms" plugin up to and including version 1.4.3
Users are advised to update their plugin to the latest version, which as of this date is version 1.4.5. There is no migitation measure.
